Currently we're using the _bulk_create API when duplicating rules, which results in having to null out all the fields that shouldn't be there on create like enabled, updated_by, etc. This conceals a failure point if any additional fields are added to rules that can't be set on create (which we ran into during 7.6 FF). Having a dedicated duplicate endpoint that takes either a list of ID's, or a query (in effort to support select all rules on all pages functionality) would clean this up while also providing a more semantic API for creating copies of rules.
Currently we're using the
_bulk_create
API when duplicating rules, which results in having to null out all the fields that shouldn't be there on create likeenabled
,updated_by
, etc. This conceals a failure point if any additional fields are added to rules that can't be set on create (which we ran into during 7.6 FF). Having a dedicatedduplicate
endpoint that takes either a list of ID's, or a query (in effort to supportselect all rules on all pages
functionality) would clean this up while also providing a more semantic API for creating copies of rules.Current API call for the
duplicate rule
action:https://github.com/elastic/kibana/blob/f890776e6dbc353132f2d392447b77951498dad3/x-pack/legacy/plugins/siem/public/containers/detection_engine/rules/api.ts#L183-L201